$username is generated from user supplied info following very strict data sanitation (no special chars and a bunch of other checks for sql injection and other attacks). $filename is a basically int(rand(1000000))